disclude.iouv 0.13.5
- Source
- https://github.com/astral-sh/uv
- Artifact scanned
uv-0.13.5.tar.gz- Compared with
uv-0.13.4.tar.gz(0 signals introduced since)- Files
- 821 scanned, 215 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 0 warn · 43 info
- Scan time
- 10.7 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): 12 of 12 warn and critical signals; 12 demoted to info.
- Disclude version
- 4.3.0
- Scanned (UTC)
- 2026-10-23 09:45
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
# On macOS and Linux. |likely benign Documentation of the official uv install script piped via curl to sh.Reasoning
The README documents the standard uv installer one-liner, which is the official install method for the project. Piping a well-known vendor install script into sh is a common, legitimate pattern, though it is a supply-chain-sensitive practice worth noting.
-
dismissed IPA phonetic notation in README prose triggers a mixed-script warning.
Reasoning
The IPA pronunciation annotation /juː viː/ naturally mixes Latin letters with IPA phonetic symbols (ː, ju). This is ordinary prose in a README, not an identifier used for deception.
-
dismissed IPA phonetic notation in README prose triggers a mixed-script warning.
Reasoning
Same as the sibling finding: the IPA transcription 'viː' in documentation prose contains the length mark and is legitimate.
-
<h1>Links for h1> <a href="/whl/Jinja2-3.1.2-py3-none-any.whl#sha256%3D4095ada29e51070f7d199a0a5bdf5c8d8e238e03f0bf4dcc02571e78c9ae800d">Jinja2-3.1.2-py3-none-any.a><br/> </body> </html>dismissed Test HTML fixture with a sha256 fragment flagged as base64.Reasoning
The snippet is an HTML test fixture containing a sha256 hash fragment in a link. The base64-like match is a false positive on hex-like content in a test page.
-
1..=0x5e, r##"__import__("os").fsdecode(b"/foo/\x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^/bar")"##, ),likely benign Test vector of byte escapes for Python os.fsdecode path round-tripping.Reasoning
This is a Rust test table exercising path-to-Python fsdecode conversion of all byte values. The escapes are test data for byte-level path handling, embedded in a string literal, not executed by the Rust code itself. Test-case generation for non-UTF8 paths is legitimate.
-
0x5f..=0xa3, r#"__import__("os").fsdecode(b"/foo/_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3/bar")"#, ),likely benign Test vector of byte escapes for path encoding tests.Reasoning
Same test-table context: systematic byte-range escapes used to verify path encoding behaviour in a Rust unit test. The string is data, not executed here.
-
0xa4..=0xd1, r#"__import__("os").fsdecode(b"/foo/\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1/bar")"#, ),likely benign Test vector of high-byte escapes for path encoding tests.Reasoning
Systematic byte-range escape sequences within a Rust test fixture covering non-ASCII byte values. Legitimate exhaustive testing.
-
0xd2..=u8MAX, r#"__import__("os").fsdecode(b"/foo/\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff/bar")"#, ), ]likely benign Test vector of high-byte escapes for path encoding tests.Reasoning
Final byte-range escape chunk of the same exhaustive path-encoding test table. Legitimate test data.
-
/// the formatter out of line to avoid duplicating it at call sites. -
"space in middle", "alpha-α", ]; for input in failures -
assert_snapshot! -
@" Expected either `,` (separating extras) or `]` (ending the extras section), found `α` foo[bar α] ^ -
Expected either `,` or `]` , found `α` foo ^ " -
assert_snapshot! -
Expected one of `@`, ` -
assert_snapshot! -
assert_snapshot! -
@r#" Unexpected character 'α', expected 'and', 'or' or end of input foo; python_version == "3.12" αx ^^ -
Unexpected character 'α', expected 'and', 'or' or end of input foo; python_version == "3.12" αx ^^ "# -
Unexpected character 'α', expected 'and', 'or' or end of input foo; python_version == "3.12" αx ^^ "# -
-
-
@r#" Unexpected character 'α', expected end of input os_name == "nt" αx ^^ -
Unexpected character 'α', expected end of input os_name == "nt" αx ^^ "# -
Unexpected character 'α', expected end of input os_name == "nt" αx ^^ "# -
// Unicode "α", "férrîs", "안녕하세요", -
// Python implementations vary // https://github.com/pypa/pyproject-metadata/pull/150/files#diff-7d938dbc255a08c2cfab1b4f1f8d1f6519c9312dd0a39d7793fa778474f1fbd1L135-R141 let _ = writeln!; } -
"cGF0Cg==", "MTFBQlVDUjZBMERMUTQ3aVphN3hPdV9qQmhTMkZUeHZ4ZE13OHczakxuZndsV2ZlZjc2cE53eHBWS2tiRUFwdnpmUk8zV0dDSUhicDFsT01aago=", ];likely benign Base64 test fixture values in a Rust test crate.Reasoning
The array holds base64 values in a test crate, including strings like 'cGF0Cg==' (decodes to 'pat'). These are test fixtures for credential or string handling; the snippet shows no decoding-and-execution behaviour.
-
"cGF0Cg==", "MTFBQlVDUjZBMDJTOFYwMTM4YmQ0bV9uTXpueWhxZDBrcllROTQ5SERTeTI0dENKZ2lmdzIybDFSR2s1SE04QW8xTUVYQ1I0Q1YxYUdPRGpvZQo=", ];likely benign Base64 test fixture values in a Rust test crate.Reasoning
Base64 strings in a test array, consistent with test fixtures for token or credential handling in uv's test suite. No execution context appears.
-
ub const READ_ONLY_GITHUB_SSH_DEPLOY_KEY: &str = "LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUFNd0FBQUF0emMyZ3RaVwpReU5UVXhPUUFBQUNBeTF1SnNZK1JXcWp1NkdIY3Z6a3AwS21yWDEwdmo3RUZqTkpNTkRqSGZPZ0FBQUpqWUpwVnAyQ2FWCmFRQUFBQXR6YzJndFpXUXlOVFV4T1FBQUlikely benign Base64-encoded SSH deploy key constant used as a test fixture.Reasoning
The constant is a base64-encoded OpenSSH private key, which decodes to a test deploy key in the 'READ_ONLY' naming. It is a test fixture for SSH git tests. Because it is a private key, it warrants a check that it is not a live credential, but the name and format suggest a fake or read-only test key.
-
let first = Named;dismissed Package URL with a sha256 fragment in a Rust test.Reasoning
The base64-like blob is a sha256 hash fragment in a package URL inside a unit test, which is ordinary requirement-parsing test data.
-
] sdist = wheels = -
] sdist = wheels = -
, ] "# -
, ] -
let requirements_in = context.temp_dir.child; requirements_in.write_str?; uv_snapshot! -
sdist = wheels = -
, ] -
sdist = wheels = -
, ] -
version = "2.0.0" archive = ----- stderr ----- -
hint: You're on , but `a` only has wheels for the following platform: `macosx_10_0_ppc64`; consider adding "sys_platform == '[PLATFORM]' and platform_machine == '[MACHINE]'" to `tool.uv.required-environments` to ensure uv resolves to a version with compatible wheels "#); -
, , ]
Reproduce This Scan
Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
|
&&